How to create a panel that shows Unique URI by IP?

[SecDesh]

Good Afternoon, I am attempting to create a panel that shows me the unique URIs that have been accessed by a specific IP, with counts associated with the URI. I'm trying to get it to where it tells me something like this:

10.20.30.40 accessed www<.>google<.>com 40 times.

Here is my current query:

Index=nsm
| stats list(uri) by src_ip

This displays what I want but with duplicates, and it provides no counts. I tried adding | dedup with it which shows everything only once, but again no count.

Index=nsm
| chart count by src_ip,uri

This provides me the information/details of what I'm looking for, however the display is not ideal, and it doesn't show all URI's since it caps at OTHER.

Any information would be greatly appreciated

[ITWhisperer]

Index=nsm
| stats count by src_ip,uri

or

Index=nsm
| chart useother=f count by src_ip,uri

[SecDesh]

The first query you provided is close since it provides the counts per URI, however it segregates the IP for every single uri. So instead of lumping all the URIs under 10.20.30.40, I instead see 10.20.30.40 multiple times for each URI.

The second query doesn't provide me all of the URI's. It caps at 10 and doesn't shown anymore. Even though I know that the IP has accessed a specific website.

[ITWhisperer · Accepted solution]

Index=nsm
| stats count by src_ip,uri
| eval accesses="accessed ".uri." ".count." times"
| stats list(accesses) as accesses by src_ip

[SecDesh]

Exactly what I was looking for. Thank you.

[gcusello]

Hi @SecDesh,

if you want the list of uri for each src_ip and the total count of connection, you could use something like this:

Index=nsm
| stats values(uri) AS usi count BY src_ip

if you want the value for each uri, you could one of these solutions:

all in rows

Index=nsm
| stats count BY src_ip uri

in a table:

Index=nsm
| chart count OVER uri BY src_ip

Ciao.

Giuseppe

[SecDesh]

The first query you provided as you stated only shows the total counts of connections. I'm looking  to display the count for every individual URI.

The second query you provided is close since it provides the counts per URI, however it segregates the IP for every single uri. So instead of lumping all the URIs under 10.20.30.40, I instead see 10.20.30.40 multiple times for each URI.

The third query doesn't provide me all of the IP's. It caps at 10 and doesn't shown anymore. Even though I know there are more IPs in my network. Again, extremely close, but it doesn't prevent all of the information I desire.

[gcusello]

Hi @SecDesh,

could you explain which output are you waiting for?

Ciao.

Giuseppe

[SecDesh]

ITWhisperer has provided the exact search query here:

Index=nsm
| stats count by src_ip,uri 
| eval accesses="accessed ".uri." ".count." times"
| stats list(accesses) as accesses by src_ip

I was looking for an output that would display the amount of times an IP accessed a URI. I wanted to group the URIs under one IP instead of having them separated.

The search query I put in this reply will display this output:

10.20.30.40 accessed www<.>youtube<.>com 7 times
                          accessed www<.>google<.>com 8 times
11.21.31.41 accessed www<.>youtube<.>com 10 times